alban/docker-vulnerable-dvwa
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

dvwa updated

Browse source
This commit is contained in:
OPSXCQ 2018-10-12 15:49:58 +00:00
parent 8f3c3af4fb
commit c37af6fc80
No known key found for this signature in database
GPG key ID: 9AD730FE9CDE5661
84 changed files with 1873 additions and 605 deletions
Download patch file Download diff file Expand all files Collapse all files

14
dvwa/login.php
View file

@ -13,26 +13,26 @@ if( isset( $_POST[ 'Login' ] ) ) {
$user = $_POST[ 'username' ];
$user = stripslashes( $user );
$user = mysql_real_escape_string( $user );
$user = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $user ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass = $_POST[ 'password' ];
$pass = stripslashes( $pass );
$pass = mysql_real_escape_string( $pass );
$pass = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $pass ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
$pass = md5( $pass );
$query = ("SELECT table_schema, table_name, create_time
FROM information_schema.tables
WHERE table_schema='{$_DVWA['db_database']}' AND table_name='users'
LIMIT 1");
$result = @mysql_query( $query );
if( mysql_num_rows( $result ) != 1 ) {
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query );
if( mysqli_num_rows( $result ) != 1 ) {
dvwaMessagePush( "First time using DVWA.<br />Need to run 'setup.php'." );
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'setup.php' );
}
$query = "SELECT * FROM `users` WHERE user='$user' AND password='$pass';";
$result = @mysql_query( $query ) or die( '<pre>' . mysql_error() . '.<br />Try <a href="setup.php">installing again</a>.</pre>' );
if( $result && mysql_num_rows( $result ) == 1 ) { // Login Successful...
$result = @mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '.<br />Try <a href="setup.php">installing again</a>.</pre>' );
if( $result && mysqli_num_rows( $result ) == 1 ) { // Login Successful...
dvwaMessagePush( "You have logged in as '{$user}'" );
dvwaLogin( $user );
dvwaRedirect( DVWA_WEB_PAGE_TO_ROOT . 'index.php' );
@ -120,7 +120,7 @@ echo "
<div id=\"footer\">
<p>" . dvwaExternalLinkUrlGet( 'http://www.dvwa.co.uk/', 'Damn Vulnerable Web Application (DVWA)' ) . " is a RandomStorm OpenSource project.</p>
<p>" . dvwaExternalLinkUrlGet( 'http://www.dvwa.co.uk/', 'Damn Vulnerable Web Application (DVWA)' ) . "</p>
</div> <!--<div id=\"footer\"> -->